We consider a bunch of remote clients connecting to our Java server over SSL sockets. Naturally, we generate a private key for each client, and perhaps import all our clients' self-signed certificates into our server truststore.

<!--break-->

<div style="border-bottom: solid 1px; background-color: #ccff00; font-size: 11pt; font-style: italic;"><img src="http://upload.wikimedia.org/wikipedia/commons/5/55/Gnome-security-medium.svg" border="0" align="left" hspace="0"/> Part of "The Enigma Posts"
</div>

<br>

In this article, we'll sign the client certificates using a local CA certificate. In this case our truststore contains our CA certificate only. However, our server should somehow support certificate revocation, so that we can disable devices that go amiss.

